<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>filters 聚合 | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'search-aggregations-bucket-filters-aggregation.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/search-aggregations-bucket-filters-aggregation.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/search-aggregations-bucket-filters-aggregation.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/search-aggregations-bucket-filters-aggregation.html" rel="nofollow" target="_blank">../en/search-aggregations-bucket-filters-aggregation.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch 权威指南 [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="search-aggregations.html">聚合</a></span>
»
<span class="breadcrumb-link"><a href="search-aggregations-bucket.html">桶(bucket)聚合</a></span>
»
<span class="breadcrumb-node">filters 聚合</span>
</div>
<div class="navheader">
<span class="prev">
<a href="search-aggregations-bucket-filter-aggregation.html">« filter 聚合</a>
</span>
<span class="next">
<a href="search-aggregations-bucket-geodistance-aggregation.html">geo_distance 聚合 »</a>
</span>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="search-aggregations-bucket-filters-aggregation"></a>多个过滤器(filters)聚合
</h2>
</div></div></div>
<p>定义一个多桶聚合，其中每个桶都与一个过滤器相关联。每个桶都会收集与其关联的过滤器匹配的所有文档。</p>
<p>示例：</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT /logs/_bulk?refresh
{ "index" : { "_id" : 1 } }
{ "body" : "warning: page could not be rendered" }
{ "index" : { "_id" : 2 } }
{ "body" : "authentication error" }
{ "index" : { "_id" : 3 } }
{ "body" : "warning: connection timed out" }

GET logs/_search
{
  "size": 0,
  "aggs" : {
    "messages" : {
      "filters" : {
        "filters" : {
          "errors" :   { "match" : { "body" : "error"   }},
          "warnings" : { "match" : { "body" : "warning" }}
        }
      }
    }
  }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/460.console"></div>
<p>
上面的例子是对日志(logs)的消息的分析。

例子中的聚合将构建两个日志的消息的集合(桶)——一个用于所有包含错误的消息，另一个用于所有包含警告的消息。
</p>
<p>响应：</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
  "took": 9,
  "timed_out": false,
  "_shards": ...,
  "hits": ...,
  "aggregations": {
    "messages": {
      "buckets": {
        "errors": {
          "doc_count": 1
        },
        "warnings": {
          "doc_count": 2
        }
      }
    }
  }
}</pre>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="_anonymous_filters"></a>匿名过滤器
</h3>
</div></div></div>
<p>filters 字段也可以指定为一个筛选器数组，比如下面这个请求：</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">GET logs/_search
{
  "size": 0,
  "aggs" : {
    "messages" : {
      "filters" : {
        "filters" : [
          { "match" : { "body" : "error"   }},
          { "match" : { "body" : "warning" }}
        ]
      }
    }
  }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/461.console"></div>
<p>过滤后的桶按照请求中给定的顺序返回。这个例子的响应是：</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
  "took": 4,
  "timed_out": false,
  "_shards": ...,
  "hits": ...,
  "aggregations": {
    "messages": {
      "buckets": [
        {
          "doc_count": 1
        },
        {
          "doc_count": 2
        }
      ]
    }
  }
}</pre>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="other-bucket"></a>其他桶（<code class="literal">other_bucket</code>）
</h3>
</div></div></div>
<p>
可以设置 <code class="literal">other_bucket</code> 参数，以便向响应中添加一个桶，该桶将包含不匹配任何给定的过滤器的所有文档。

该参数的值可以设置为：
</p>
<div class="variablelist">
<dl class="variablelist">
<dt>
<span class="term">
<code class="literal">false</code>
</span>
</dt>
<dd>
不会计算 <code class="literal">other</code> 桶
</dd>
<dt>
<span class="term">
<code class="literal">true</code>
</span>
</dt>
<dd>
计算并返回 <code class="literal">other</code> 桶，当使用命名过滤器时返回一个命名(默认名称为 <code class="word">_other_</code>)的桶，否则（使用匿名过滤器时）就是返回的桶中的最后一个
</dd>
</dl>
</div>
<p>
参数 <code class="literal">other_bucket_key</code> 可用于设置 <code class="literal">other</code> 桶的键，以取代默认的<code class="word">_other_</code>。

设置此参数将隐式地将 <code class="literal">other_bucket</code> 参数设置为<code class="literal">true</code>。
</p>
<p>
下面的代码片段显示了一个响应，其中 <code class="literal">other</code> 桶在请求中被命名为 <code class="word">other_messages</code>。
</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT logs/_doc/4?refresh
{
  "body": "info: user Bob logged out"
}

GET logs/_search
{
  "size": 0,
  "aggs" : {
    "messages" : {
      "filters" : {
        "other_bucket_key": "other_messages",
        "filters" : {
          "errors" :   { "match" : { "body" : "error"   }},
          "warnings" : { "match" : { "body" : "warning" }}
        }
      }
    }
  }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/462.console"></div>
<p>响应应该是这样的：</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
  "took": 3,
  "timed_out": false,
  "_shards": ...,
  "hits": ...,
  "aggregations": {
    "messages": {
      "buckets": {
        "errors": {
          "doc_count": 1
        },
        "warnings": {
          "doc_count": 2
        },
        "other_messages": {
          "doc_count": 1
        }
      }
    }
  }
}</pre>
</div>
</div>

</div>
<div class="navfooter">
<span class="prev">
<a href="search-aggregations-bucket-filter-aggregation.html">« filter 聚合</a>
</span>
<span class="next">
<a href="search-aggregations-bucket-geodistance-aggregation.html">geo_distance 聚合 »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>